I've upgraded to 1.61 and getting the csrf token via javascript doesn't seem to be working, before any other JS runs I have
echo \Security::js_fetch_token();
when I look at the source the function is printing, my cookie settings have http_only set to false, am I missing any other config settings that might attribute to this?